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O . Abstract 
(N 

Ch ' We consider the Gaussian wiretap channel, where two legitimate players Alice and Bob communicate 

over an additive white Gaussian noise (AWGN) channel, while Eve is eavesdropping, also through 
an AWGN channel. We propose a coding strategy based on lattice coset encoding. We analyze Eve's 
' probability of decoding, from which we define the secrecy gain as a design criterion for wiretap lattice 

codes, expressed in terms of the lattice theta series, which characterizes Eve's confusion as a function 
of the channel parameters. The secrecy gain is studied for even unimodular lattices, and an asymptotic 
. analysis shows that it grows exponentially in the dimension of the lattice. Examples of wiretap lattice 

K*" ' codes are given. Interestingly, minimizing Eve's probability of error involves the same optimization of 

OO ' the theta series as does the flatness factor, another newly defined code design that characterizes lattice 

code.*.,.ch.eve.„o„g„c„c, 

cn 

O ■ 

Index Terms 
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■ I. Introduction 



The wiretap channel was introduced by Wyner 11341 as a discrete memoryless broadcast channel where 
the sender, Alice, transmits confidential messages to a legitimate receiver Bob, in the presence of an 
eavesdropper Eve. Wyner defined the perfect secrecy capacity as the maximum amount of information 
that Alice can send to Bob while insuring that Eve gets a negligible amount of information. He also 
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described a generic coding strategy known as coset coding, used to encode together both data and random 
bits to confuse the eavesdropper. The question of determining the secrecy capacity of many classes of 
channels has been addressed extensively recently, yielding a plethora of information theoretical results 
on secrecy capacity |[T9l . In particular, the secrecy capacity of the Gaussian wiretap channel is known, 
and was established in ifTSl . 

There is a sharp contrast with the situation of wiretap code designs, where very little is known. 
Ozarow and Wyner proposed the so-called wire-tap II codes ll25l for a scenario where the channel to 
Bob is a noiseless binary channel, while Eve experiences erasures. Recently polar wiretap codes have been 
proposed for symmetric binary input channels ||22| . ||T2| . The most exploited approach to get practical 
codes so far has been to use LDPC codes, for binary erasure and symmetric channels (for example (32]), 
but also for Gaussian channels with binary inputs IITtI . 

In this work, we consider lattice codes for Gaussian channels, where Alice uses lattice coset encoding. 
Lattice codes for Gaussian channels have been considered from an information theoretical point of view 
in Ifm in the setting of cooperative jamming, and more recently in 11201 . Il2n . where lattice codes have 
been considered for respectively the mod A Gaussian wiretap channel, and the Gaussian wiretap channel. 
Both papers propose the so-called flatness factor as a new design criterion, and 11211 proves that nested 
lattice codes can achieve semantic and strong secrecy over the Gaussian wiretap channel. We focus here 
on a code design criterion, which we derive from minimizing Eve's probability of correctly decoding. 
More precisely, a wiretap lattice code consists of a pair of nested lattices Ae C A^, where Af, is a lattice 
designed to ensure reliability for Bob, while Ag is a sublattice of A^, that increases Eve's confusion. We 
show that Eve's probability Pc e of correctly decoding a message intended to Bob is bounded by a function 
that depends on the noise on Eve's channel, and on the theta series of the lattice Ag at a particular point. 
Interestingly, the theta series at that same point also provides an upper bound on the mutual information 
between Alice's message and Eve's received message [21 1. Mimicking the way the coding gain quantifies 
how much reliability a particular coding strategy brings with respect to uncoded transmission, we define 
the secrecy gain to quantify how much confusion a specific lattice provides compared to using the Z" 
lattice. An asymptotic study of the secrecy gain and wiretap lattice codes are further presented. 

The paper is organized as follows. Section JI] recalls the channel model, how lattice coset encoding is 
performed, while Section JII] contains an analysis of Eve's probability of correctly decoding, from which 
design criteria are deduced. The notion of secrecy gain is defined, illustrated and interpreted in Section 
HVl It is further analyzed for even unimodular lattices in Section jV] The asymptotic analysis which 
describes the behavior of the secrecy gain when the lattice dimension grows is presented in Section rvT] 
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Finally some wiretap lattice codes can be found in Section IVIII 

II. Coding Scheme for the Gaussian Wiretap Channel 

A. The Gaussian Wiretap Channel 

We consider a Gaussian wiretap channel, that is, a broadcast channel where the source (Alice) sends 
a signal to a legitimate receiver (Bob), while an illegitimate eavesdropper (Eve) can listen to the trans- 
mission. It is modeled by 

y = x + Vb 

Z = X + Ve-, 

where x is the transmitted signal, and Vf, denote the Gaussian noise at Bob, respectively Eve's side, 
both with zero mean, and respective variance cr^ and a1 (see Figure [1}. We assume that Alice knows 
Bob's channel, that is a^), as well as Eve's channel, tJe, though we will also show how to handle the case 
where Eve's channel is unknown (see Section IVIII ). 



Alice 



Data bitH encode 
A(,/A,. 



Eve 




Bob 



Fig. 1. The Gaussian wiretap channel between the sender Alice, and the two receivers Bob and Eve. 



Alice's encoder maps I bits si, . . . , from S = {0, 1} to a codeword x = (xi, . . . , Xn) G M", and 
over a transmission of n symbols, we get 

y = x + v, 

Z = X + Vg. 

We consider the case where Alice uses lattice codes, namely x G Af,, where Aj, is an n-dimensional 
real lattice (we use the subscript h to refer to the intended legitimate receiver Bob). She then encodes 
her I bits into a point x G A;,: 

S = (Si, . . . , S;) G {0, 1}' X = (Xi, . . . , Xn) G Afo. 
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Note that since Alice encodes a finite number I of bits per codeword, she needs to choose a finite subset 
of A;,. The problem of finding a shaping region TZ is not addressed here. 

We recall for the sake of completeness that a lattice A is a discrete set of points in M", which can be 
described in terms of its generator matrix M by |[24l . |[6ll 



where the m rows of M form a linearly independent set of vectors in M" (so that m < n) which form 
a basis of the lattice. To every lattice A is associated its dual lattice A* defined as follows. 

Definition 1: Let A be a lattice with generator matrix M. We call its dual lattice the lattice A* with 
generator matrix (Af^^)^. 

For any lattice point Pi of a lattice A C M", its Voronoi cell is defined by 



All Voronoi cells are the same, thus VA{Pi) = Va(0) =: V (A). The volume of a lattice A with generator 
matrix M is by definition the volume vol(V(A)) of a Voronoi cell, that is 



B. Wyner's Coset Encoding 

In order to confuse the eavesdropper, we use coset coding, as proposed in ||34l . ||25l . The idea is that 
instead of having a one-to-one correspondence between a vector of information bits and a lattice point, 
this vector of information bits is mapped to a set of codewords, namely a coset, after which the point to 
be actually transmitted is chosen randomly inside the coset. Consequently, k bits (/c < /) of s G {0, 1}' 
will carry the information and / — k bits, the randomness. 

More precisely, we partition the lattice A^ into a union of disjoint cosets of the form 



with Ag a sublattice of A^ and c an n-dimensional vector. We need 2^ cosets to be labeled by the 
information vector € {0, 1}'': 



A = {x = uM I u G r^] 



VA{Pi) = {x G M'^, d(x,Pi) < d{^,Pj) for all Pj G A}. 




V(A) 



Ae + C 



Ab = uf^^iAe + Cj) 



which means that 



Ab/Ae 



Vol(V(Ae)) 
Vol(V (Afe))- 



(2) 
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Label points with data + random symbols Label points with random symbols 

— • • • • • 



/ / 

Transmitted point Transmitted point 

Label points with data 
• • • 

/ 

Transmitted point 



Fig. 2. Coset Coding with uniform noise: Z/mZ with jn = 3. 



Once the mapping 

Sd l-> Ae + Cj(s^) 

is done, Alice randomly chooses a point x G Ag + Cj(sd) and sends it over the wiretap channel. This is 
equivalent to choose a random vector r G Ag. The transmitted lattice point x G A;, is finally of the form 

X = r + c G Ae + c. (3) 

We have denoted the sublattice Ag, since it encodes the random bits that are there to increase Eve's 
confusion, and is then the lattice intended for Eve. 
The total rate R is then 

R = Rs + Re, 

where Rg is the information bits rate intended to Bob, and Re is the random bit rate, all per (complex) 
channel use: 

Rs = — ^=> k = — -, Re = — r = — -, (4) 

n In 1 

where r is the number of random bits. 

Intuitively, the meaning of this coding scheme is that we would like Eve to decode perfectly the lattice 
Ag whose points are labeled by the random bits. This corresponds to the information-theoretic approach 
|[T9l where it is shown that the secrecy capacity is equal to the difference between Bob's capacity and 
Eve's and thus, it is desirable that Eve's capacity is wasted in decoding random bits. 

Example 1: Assume that the channel between Alice and Eve is corrupted by an additive uniform noise. 
Even though this is not a realistic channel this perfectly illustrates the coset coding strategy. We will see 
that, in this case, it is enough to consider the Z lattice. 

Consider the one-dimensional case (see Figure |2]i where Alice sends one point x G Eve receives 

y = X + V 
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where v is uniformly distributed over the interval [— -y, ^] some m G Z, as shown on the upper left 
Figure |2] To confuse Eve, Alice performs coset coding as follows: 

• she performs the Euclidean division 

X = mq + r,0 < r < m (5) 

where the quotient q carries the random symbols while the remainder r carries the data. 

• she encodes random symbols using points in mZ (the quotient q) while data symbols are mapped 
to elements of Z/mZ (the remainder r). This is illustrated in the upper right and the lower parts of 
Figure |2] 

Now, as it can be seen in Figure |2] Eve is able to detect with a zero-error probability the value of q in 
Equation (|5]l while all possible values of r will be detected with probability ^. This means that random 
symbols will be detected error-free when the confusion will be maximal for data symbols already when 
we use a one-dimensional lattice (that is n = 1). 

Unfortunately, Gaussian noise is not bounded: it requires to use n— dimensional lattice codes. Table 
[J recalls the one-dimensional approach and shows the equivalent lattices with their respective cosets in 
the multi-dimensional approach required by the Gaussian channel. 





1— dimensional 


n— dimensional 


Transmitted lattice 


Z 


Fine lattice At, 


Random symbols 


mZ C Z 


Coarse lattice Ae C A;, 


Data 


Z/mZ 


Cosets Ab/Ae 



TABLE I 

From the example to the general scheme 



Example 2: Consider the 2-dimensional lattice 2Z^, that is 

2Z2 = {(2x,2y), x,2/GZ}, 

and its cosets 

2^2 + (0,1) = {(22;,2y + 1), G Z}, 
2Z2 + (1,1) = {(2x + l,2y + l), gZ}, 
2Z2 + (1,0) = {(2x + l,2y), x,y gZ}. 
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We note that if we take the union of 21? and its 3 cosets, we recover the lattice 1?: 



If 



{(x, y), X, y G Z} = 27? U {27? + (0, 1)) U {21? + (1,0)) U {,21? + (1, 1)). 



This is shown in Figure |3j where 21? is represented by the triangles, 21? + (0, 1) by the squares, 
21^ + (1, 1) by the circles, and finally 21^ + (1,0) by the stars. 
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Fig. 3. The lattice Z seen as the union of 4 cosets. 



Alice wants to communicate a message to Bob using the Gaussian wiretap channel given in (dJ. Assume 
that she can use 2 bits per channel use, she can then label any of the above 4 cosets, say 

00h^2Z^ 01 (2Z2 + (0, 1)), lOh^ (2Z2 + (1,0)),11 (2Z2 + (1,1)). 

To transmit the two bits 01, she then randomly picks a point in the coset 21? + (0, 1), say (2, 3), and 
sends this point over the wiretap channel. 

An interesting point to develop is the comparison, in terms of probability of correct decision for Eve, 
between the scheme proposed here and the classical scheme using a 4 — QAM constellation, that is, 
only using the symbols in the central square of Figure |3] to illustrate that coset coding does increase 
the confusion at the eavesdropper. For the classical 4 — QAM constellation, the symbol probability of 
correct decision, at Eve's end, is given by ll26l 

Pc,e = 1-2Q 



2Eb 



(6) 



where Eb is the energy per bit and A'^o = o"e is the noise variance. Q{x) is, as usual the error function 
defined as 



Qix) 



1 



+00 



e 2 



du. 
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For the proposed scheme, the calculation of the probability of correct decision (for coset elements) at 
Eve's side can be done in the following way : 

• Decompose the QAM constellation into its real and imaginary parts so that 

Pc^e = Pr {x = x} = Pr {xi = xi} Pr {x2 = X2} 

where x = xi + ix2 is the transmitted QAM symbol and x is the detected QAM symbol. By 
symmetry of the constellation, we have 

Pr {xi = xi} = Pr {x2 = X2} =■ Pr {x = x} . 

• Now, as can be seen on Figure |3] 

Fv{x = x} = ^ (Pr {x = A|x = A} + Pr{x = o, njx = o, □}) 
= Pr {x = -k, A\x = A} = Pr {£ = o, n\x = o, □} 

Pe,e = (Pr{x = *,A|x = *,A})2. 



so that 



(7) 



By summing over all coset representatives, we finally get that the probability of correct decision for 
Eve is 

2 



Pr 



c,e 



1 - ^ (5Q ( V^) - 4Q + 3Q (5\/^) - 2Q (jVo^ + Q (9V9 



where 9 = 

35 No 



(8) 
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Fig. 4. Probability of the eavesdropper correctly decoding the cosets. 4 — QAM vs coset scheme 1? I2T? 
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As an illustration, i-*c,e as computed in ([8]) is plotted in Figure |2] with the probability of correct decision 
for Eve when using a A — QAM constellation. We observe that, if the SNR is either too big (above 15 dB) 
or too small (below -13 dB), there is no gain in using the coset scheme. Indeed, when the SNR goes 
below -13 dB, the size of the sphere of noise is such that it includes too many representatives of the 
correct coset, so that Eve's probability of guessing the coset that was sent is not negligible anymore. 

The example above shows the benefit of using coset encoding. However, it also illustrates that Pc,e is 
no less than 0.3. We need to bring this threshold as low as possible (ideally tending to 0). This can be 
done by using multidimensional lattice coding in high dimension. 

C. Lattice Coset Coding using Construction A 

There are several ways of getting lattice coset codes. We will consider the so-called binary construction 
A im with binary codes. Take the standard lattice Z" G M" and reduce it modulo 2 : 

p:Z"^(Z/2Z)" = {0,ir. 

Let C be a linear binary code with parameters (n, k, d), that is a map from {0,1}'^ to {0,1}" with 
minimum Hamming distance d. We can partition an n-dimensional lattice A as follows: 

K = 2r' + C = J (2Z" + Ci). 

This is also equivalent to say that A is the preimage of C in Z"^: A = p~^{C). 

Example |2] falls in this category. Take the universe code C with parameters (2,2,1), given explicitly 
by {(0,0), (0,1), (1,0), (1,1)}. Then 

Z^ = 2Z2 + C = (2Z2 + (0, 0)) U (2Z2 + (0, 1)) U {2Z'^ + (1, 0)) U {2Z^ + (1, 1)). 

Another 2-dimensional example is given by the checkerboard lattice D2, formed by integer vectors 
(xi,X2) such that xi + X2 is even. Consider the 2-dimensional repetition code {(0,0), (1, 1)}. Then 

D2 = 2Z^ + C= {21? + (0, 0)) U (2Z2 + (1, 1)). 

A more interesting example is the construction of the Schaffli lattice D^, formed by (xi, X2, X3, X4) such 
that xi + X2 + X3 + X4 is even: 

L>4 = 2Z'' + (4, 3, 2) 

where (4, 3, 2) is the parity-check binary code of length 4, dimension 3 and minimum distance 2. 
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III. Probability Analysis 

A. Coset Decoding 

After transmission over the Gaussian wiretap channel, Bob and Eve receive respectively (see ([1} and 
®) 

y = X+Vfe =r+C+Vfe 
Z = X + Ve = r + C + Ve, 

where we recall that r G Ag encodes the random bits, and c is the coset representative of minimum 
energy labeled by the information bits. Both Bob and Eve are interested in decoding the information bits, 
namely in finding the correct coset that was sent. To do so, they need to find the closest lattice point in 
A;, to their respective received signal y or z, from which they deduce the coset to which it corresponds. 

Now when transmitting a codeword x in A C M" with Voronoi cell Va(x) over an additive white 
Gaussian noise channel with noise variance o"^, the decoder makes the correct decision if and only if the 
noisy vector y is in Va(x), an event of probability 

\ / e-lly-x||V2-^rfy 

In our scenario, the probability Pc of correct decision concerns not just one point but a coset, and thus 
it is the probability that the received signal lies in the union of the Voronoi regions of A;,, translated by 
points of Ag. Suppose that the lattice point x = r + c G A;, has been transmitted, with r G Ag n 7^ C A;,, 
where TZ is the shaping region of the constellation. The probability of finding the correct coset is 
thus. 



Pc = ^^ V / e-\\y--\\'l'^'dy. (9) 

Since all terms in the sum of Equation ^ are positive, we can upperbound it by extending the 
summation over the whole lattice Ag, which gives 



Pc< / e-W^-^W'l^'^'dy. 



If we take M codewords from A;,, then and by doing the change of variable, u = y — x — t we get 

Pg< I e-ll"+*IIV2a^du. (10) 

Accordingly, the probability Pg f, of Bob's (resp. Pg g of Eve's) correct decision is: 

Pg, < y f eHI"+*IIV2-?du (11) 



Pgg < ^ y eHl"+*ll^/2.,^du. (12) 



teAe ' 
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Since Bob's received vector y is most likely to lie in the Voronoi region of Af, around the transmitted 
point (Alice chooses A;, to fit Bob's channel), the terms in t different from in ([TT] ) are negligible, 
which yields: 

P,,<—1 I e-IHIV2.?^^,. (13) 



(V27ro-b)" Jv(A,) 

This is now the familiar case of transmitting lattice points over the Gaussian channel, for which it is 
known that Af, should have a good Hermite parameter, to get a good coding gain 

B. Eve 's Probability of Correct Decision 
By (O, we need to evaluate 

y [ e-ll"+*ll^/2..^du = / y e-""+*"^/2'^^du (14) 

where t G Ag. By denoting 

the Poisson formula for lattices (see (|52] i in the appendix) yields that 

fit) = vol(V(A,))-i /(t'^) 
t6A„ t*eA* 

where A* is the dual lattice of A (see Definition [T]). We next compute /(t*), which by definition is 

fit*) = [ e-2-<**'^>/(v)(fv 



,=1 -^M 



9 —l 2(7^ (wit* + ^ 



using that 



This yields 



^-ax-^-2bx^^ = y^e^'/", a > 0. (15) 



-=L^j:/(t) = voi(v(A.))- 

^2n„2|U.||2 



vol(V(Ae))-i ^ e-^2.,^||t1Pg-2..(t*,u> 
t*GA* 

l(V(Ae))-i J] e-"'2-.^ll**ll'cos(27r(t*,u)) 



vo. ^ 

t*eA 
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by noting that the sine term of the exponential averages out to zero when summing over all lattice points, 
and 

i'ce < vol(V(Ae))-^ / y e-"'2-^l|t1P(,og(27r(t*,u))du. 
Now the cosine term takes it maximum value (that is 1) when u G A, and we further get 

^V(A.)t*6A* 



vol(V(A5)) 



V0l(V(Ae)) ^^^^ 

To obtain an expression which depends on A instead of A*, we denote this time 



and the Poisson formula for lattices (see (|52] | in the appendix) now gives that 

/r)=V0l(V(Ae))J]/(t) 



where /(t) is 



t*6A* teA 



/(t) = / e-2^^<*'^>/(v)(iv 



e 




using that (fTSl ). Finally the probability of making a correct decision for Eve is summarized by 

We can equivalently rewrite it in terms of generalized SNR (GSNR) 7A^(<7e) as 

(2»<7|)"/2 vol(V(A.)) ^.^^ 

where 

V0l(V(Ae))^/" 

7A.(ae) = ^^^^^ (18) 

January 10, 2013 DRAFT 



13 



is the generalized signal-to-noise ratio (GSNR), and using ([2]) and 

We know how to design good codes for Bob's channel, and have his probability of making a correct 
decision arbitrarily close to 1. Our aim is thus to minimize the probability Pc,e of Eve making a correct 
decision, while keeping Pc^b unchanged. This is equivalent to minimize (fT6l ). that is to find a lattice At 
which is as good as possible for the Gaussian channel ||6], and which contains a sublattice Ag such that 



minimize w.r. Ag XlteA ^ H*!!^/^""^ 
under the constraint log2 |Ab/Ae| = k. 



(19) 



The constraint on the cardinality of cosets (or rate) is equivalent to set the fundamental volume of Ag 
equal to a constant. 

It is natural to start by approximating the sum of exponentials by its terms of higher order, namely 

^ -||t||V2<x^ 

teA, teAe,||t||=d„i„(Ae) 

= l + r(Ae)e-'^™(^=)'/2.= ^ (20) 



where T(Ae) is the kissing number of Ag which counts the number of vectors of length (imin(Ae). Thus 
as a first criterion, we should maximize (imin(Ae) while preserving the fundamental volume of Ag, which 
is equivalent to require for Ag to have a good Hermite parameter 

7h(A) - "^^'"^^^ 



det(MM^)i/n 

after which we should minimize its kissing number. However we cannot be content with this approxi- 
mation, and have to obtain a more precise analysis as will be shown later on. 

IV. The Secrecy Gain: a Design Criterion 

Let us get back to the code design criterion ([T9] l and rewrite it in terms of the theta series of the lattice 
considered. Recall that given a lattice A C M", its theta series Qa is defined by Q 

eA(z) = J^glWI', q = e'^',lm{z)>0. (21) 
xeA 
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Example 3: Let us compute the theta series of Z": 

{a;i,...,x„)eZ" 

= X] ■ ■ ■ 




Exceptional lattices have theta series that can be expressed as functions of the Jacobi theta functions 
Q = e*'^^, lm{z) > 0, i = 2,3,4, themselves defined by 

Mq) =E^=-ooQ^''^'^\ (22) 

Mq) =E;^r-oo'^"^ (23) 
Mq) =E^=-oo{-^rQ''^- (24) 

A few examples of theta series of exceptional lattices 161 are given in Table m 



Lattice A 


Theta series Oa 


Cubic lattice 


^3 


Checkerboard lattice _D„ 




Gosset lattice Es 




Leech lattice A24 





TABLE II 

Theta series of some exceptional lattices 



From ([T9] l. we need to minimize 



teAe 
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with q = e™^ and 

■■"(2i^)=""fe)>»- 
Thus to minimize Eve's probability of correct decision is equivalent to minimize Q\^{z) in z = i/2iTa1, 
under the constraint that log2 |Ah/Ae| = k. To approach this problem, let us set y = —iz and restrict to 
real positive values of y. We are now interested in minimizing 



2 



over all possible Ae, in the particular value of y corresponding to 2: = ijl'Kai, namely 



Remark 1: From an information theory point of view, the information leaked to the eavesdropper 
is measured in terms of equivocation, that is H{S^\Z'^'), where S and Z denote random variables 
corresponding respectively to the data and the message received by Eve. The best possible secrecy 
is achieved when = ii{S^\ or equivalently when 

1(5'; Z") = - = 0. 

How to design codes using the mutual information /(S"'; Z") as a characterization of secrecy is not yet 
well understood. Recent progresses appeared in 11211 Theorem 5], where it was shown for the Gaussian 
wiretap channel that 

/(S'; Z") < 8e„ni? - 8e„log8e„ = e„(8ni2 - 81og8e„), 
where ll2n Proposition 1] 

en = 7AeKr/'eA^(l/27ra2)-l, 

and ((Je) is the generalized signal-to-noise ratio defined in (ITST l. Both this information theory approach 
and our error probability approach agree on the fact that 0A^(l/27rcrg), that is the theta series of the 
lattice Ae intended for Eve at the point l/27ro"g should be minimized. This bound is computed assuming 
a specific coding scheme, which takes into account a power constraint. Note that when we let the 
power grow, which corresponds to the scenario of the current paper, the way Alice encodes her message 
corresponds to choosing a point uniformly at random in a given coset, as is the case here. The interested 
reader may refer to [1211 for the connection between the flatness factor eA^{cr^) and the notion of strong 
secrecy. 
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A. Definition of Strong and Weak Secrecy Gains 

Mimicking the way the coding gain captures the benefit of a good coding strategy with respect to no 
coding in terms of probability of error, we introduce the (strong) secrecy gain to characterize how a good 
lattice Ag increases the confusion at the eavesdropper, compared to choosing Ag = Z". 

Definition 2: The strong secrecy gain XA,strong of an n— dimensional lattice A is defined by 

XA.strong = SUpSa(2/), 

where HA(y) is the secrecy function of A, defined as follows. 

Definition 3: Let A be an n— dimensional lattice of volume A". The secrecy fimction of A is given by 

^ f X Qaz" jy) 

defined for y > 0. 

These definitions deserve several observations. 

Remark 2: 1) The problem of minimizing (y) under the rate constraint log2 | Af,/Ae| = k means 
that the optimization must be performed among lattices with the same volume. To do so, we fix as 
reference a scaled version of the cubic lattice AZ", where A is a scaling factor which guarantees 



that Ag and AZ" have the same fundamental volume, namely, A = a/vo1(V(A^)). 

2) We are interested in the secrecy function at the chosen point y = However, by considering 
CTg as a variable, and since we want to minimize the expression of Eve's probability of correct 
decision in ( fT9l ). it makes sense to further maximize the secrecy function over y > 0. 

3) The secrecy function depends on a1. When Eve's channel is very noisy, there is no need for a subtle 
coding strategy (Ag = Z" will do), and vice-versa, when Eve's channel is too good, wiretap coding 
cannot help (Ag = Z" will again do). This is illustrated on Figure |5] where the behavior of the theta 
series of Z**^ and of another lattice Ago Q, both multiplied by the generalized SNR (GSNR), are 
compared, as a function of the GSNR (see ([T8])). As a consequence, the secrecy function of a given 
lattice A being the ratio of its theta series and the theta series of AZ" captures the region where 
wiretap coding is most meaningful, and provides an approximation of the ratio of the respective 
probabilities of correct decision. 

Since the maximum value in Definition |2] is not easy to calculate for a general lattice, we also introduce 
a weaker definition of secrecy gain. By (multiplicative) symmetry point, we mean a point yo such that 

SA(yo • y) = '^A{yo/y) 

'See Subsection I V-CI for more details about this lattice. 
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Probability of correct decision (Upperbound) - = 1 bit/dim 
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Fig. 5. A comparison between OaIga, for A = and A*". R, = 1 bit per real dimension. 

for all y > 0. We remark that the variable y appears in the exponent, explaining the multiplicative 
notation. One could alternatively express the symmetry point in terms of logy and logyo> yielding 

SA(log yo + log y) = Ha (log yo - log y). 



Definition 4: Suppose that A is an n-dimensional lattice, whose secrecy function has a symmetry point 
yo- Then the weak secrecy gain XA of A is given by 

^ / N 0AZ"(yo) 
XA = =A [yo) = p, / X , 
BA(yo) 

where we recall that A = vol(V(A))^ = | det(M)|^. 

B. Lattices Equivalent to their Duals 

Let us consider the class of lattices A such that A is equivalent to its dual A*, that is, the dual lattice 
A* can be obtained from the lattice A by (possibly) a rotation, reflection, and change of scale a > 0: 

A ~ ah*. 

In fact, if A ~ aA*, then a cannot be any positive number. Indeed, we deduce from the equivalence 
between both lattices that 

vol(V(A)) = a"vol(V(A*)). 
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But since A and A* are dual, then 

vol(V(A)) 



vol(V(A*)) ■ 
From these two equahties, we get 

a = vol(V(A))^. 

If a = 1, we say that A is isodual. Alternatively 

Definition 5: A lattice is isodual if it can be obtained from its dual by (possibly) a rotation or reflection. 

If M is the generator matrix of A and (M^^)^ the one of its dual, this means that (Af~^)-^ = UMB 
where ?7 is a matrix with integer entries and determinant ±1 and i? is a real orthogonal matrix. Thus 
the Gram matrix G of A, which is by definition G = MM'^, is related to the Gram matrix of its dual 
by (M-i)^M-i = UMBB'^M^U'^ = UGU^. A simple example of isodual lattice is Z", since its 
generator matrix M = I„, and the one of its dual is (Af~^)^ = I„, and both Gram matrices are the 
n-dimensional identity I„. It follows from the definition of A isodual that ©A(y) = 0A*(y). since the 
theta series depends on the norm x G A, which does not change by rotation or reflection of the 

lattice. We are now ready to establish the weak secrecy gain of isodual lattices. 

Proposition 1: The secrecy function of an isodual lattice has a multiplicative symmetry point at y = 1. 
Proof: The secrecy function of an isodual lattice A and the one of its dual A* are the same: 

0A(y) 

Jacobi's formula (l53T l gives, using that Z" and A are isodual and have thus volume 1, that 

@A{y) =y"^0A*(j) 

and 

"A(y) = T-Y = =A - 

This shows that yo = 1 is a multiplicative symmetry point for the secrecy function, which concludes the 
proof. ■ 
Consider again a lattice A equivalent to its dual, though not necessarily isodual. The above result easily 
extends to this case. 

Proposition 2: The weak secrecy gain of a lattice equivalent to its dual is achieved at 

y = vol(V(A))-^, 
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that is 

Proof: We can in fact always scale the lattice A as 

A' = i -k 

vol(V(A))^ 

so that A' is isodual. Now, since the theta series of a scaled lattice is 

QpK{y) = Qa {(3^y) , 

with here /3 = vol(V(A))~^, we deduce that 

(vol(V(A))-i . y) = E,(y) = (1) = E, (^id) , 

which shows the existence, for Ha, of a multiplicative symmetry point at yo = vol(V(A))~~. ■ 
Conjecture 1: For a lattice equivalent to its dual, the weak secrecy gain and the strong secrecy gain 
coincide. In particular, this means that the secrecy function of isodual lattices achieves its maximum at 
y = l. 

Note that a related problem has been addressed in |]7]: for a fixed dimension n, find the lattice that 
minimizes 0a (y) for some value y. Unfortunately, the obtained results hold for values of y belonging 
to a range which is not of interest. 

This conjecture is checked below for the lattices £'§ and D4. 

C. Some Examples 

a) The Gosset Lattice Eg,: The Gosset lattice is a famous 8-dimensional lattice which can be 
described by vectors of the form {xi, . . . , xg), Xi E Z, or Xj G Z + 1/2, such that ^ Xj = mod 2. 
This lattice can be obtained by construction A as 

V2Es = ll? + (8, 4, 4) 

where (8, 4, 4) is the Reed-Miiller code of length 8 and dimension 4, that is the extended binary Hamming 
(7, 4) code. Eg is an isodual lattice and its theta series is given in Table JI] As it is isodual, the symmetry 
point of its secrecy function is yo = 1. Figure |6] gives the secrecy function of Eg. The symmetric point 
is also the point at which the secrecy function is maximized. In all plots of the secrecy function, the 
horizontal axis will give y in decibels (10 logxo(y)) '^^ enlighten the symmetry point. Here, a multiplicative 
symmetry point equal to 1 is, of course, represented by an additive symmetry point equal to dB. We 
remark that the weak and the strong secrecy gains coincide. 
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Fig. 6. Secrecy function of Eg. 



b) The Schaffli lattice Di^: Z?4 is a 4— dimensional lattice which is not isodual, but it is equivalent 
to its dual. Its fundamental volume is 2. This lattice can be obtained by construction A as 

L»4 = + (4, 3, 2) 

where (4, 3, 2) is the binary parity-check code of length 4. The theta series of is also given in Table HH 
The multiplicative symmetry point is now 2/0 = Figure |7] gives its secrecy function with a symmetry 
point equal to —1.5 dB corresponding to lOlog^Q For this lattice also, the weak and the strong 

secrecy gains again coincide. 
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Fig. 7. Secrecy function of D4. 
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D. Operating Point of a Lattice 

We are interested in how the secrecy gain is related to the parameters of the Gaussian channel, through 
the proposed lattice coset construction. We restrict this discussion to lattices which are equivalent to their 
dual. In this case, from a system point of view, it is always possible to scale these lattices to normalize 
their volume to 1, in which case we obtain isodual lattices, which we showed have a symmetry point at 
y = 1 (see Proposition [T]). Thanks to Conjecture [T] we will use the weak secrecy gain instead of the 
strong one for isodual lattices and assume that we want the communication system to work at the value 
y=l. 

In practice, this is obtained by scaling suitably the lattice Ae for which we define correspondingly its 
operating point ?/o.p. as 

yo.p. =Vol(V (Ae))^. 
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Fig. 8. Secrecy function for scaled versions of _Bg. 



As an example, we see on Figure [8] how the operating point of scaled versions of Eg behaves with 
respect to the one of Eg. For 2"^Eg,m G Z, 

Vo.p. = Vol(V(2'"i^8))^ = (28™)-^ = 2-2- 

that is —6m dB. 

To fit the transmission rate, under the constraint (2), that is 

Vol(V(Ae)) 



|A,/Ae| = 2' 



Vol(V (Afe))' 
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the fundamental volume of Ap is scaled as 



Thus 



Vol (V (Ae)) = 2'^Vol (V (Af,)) = 2— Vol (V (A,)) . 

yo.p. = Vol(V(Ae))^ 

= 2^^''Vol(V(Af,))^ . 



Now, the average energy per complex symbol and per complex channel use if Alice sends a. Q — QAM 
constellation with Q = 2^ points and minimum distance 2a is ifTOl 

Es{Q-QAM) 



2(2^ - l)a- 



This can be easily extended to a (Q — QAM) 2 constellation, which can be seen as a cubically shaped 
subset of the n-dimensional lattice 2aZ": 

2 2^ - 1 
^,([2aZ"]) = Vol (V(2aZ"))- 

where [A] is a notation to refer to a cubically shaped subset of the lattice A. Now assuming that a finite 
constellation is carved from A;, with a cubic shaping, its average energy Ef^ ( [A;,] ) differs from the one of 
by its coding gain, which shows that we can approximate the energy per complex channel use and 
per complex symbol of the signal sent by Alice by 

2^-1 



£;,([Ab])~Vol(V(Ab))^ 



6 



2^ Vol (V(Ab))^ 



Hence, we get 



2-''^E,{\k^\)''2 



which with yo.p. = 2^ from (l25T l gives 



27rcj2 



2"(^-^)£;,([A,])-i 



and finally 



27rai 



27r 



(26) 



where 7e = Es/al is Eve's signal to noise ratio. This corresponds to a secrecy rate 



R, = R- loe 



2tt 



(27) 
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V. The Secrecy Gain of Unimodular Lattices 

Theta series are difficult to analyze in general, but nevertheless they have nice properties for some 
families of lattices, such as even unimodular lattices, which we will study in this section. 
Let A be a lattice with generator matrix M and Gram matrix G = MM'-^ . 
Definition 6: fSl Chap. 1] A lattice A is unimodular if 

1) A is integral, i.e., its Gram matrix has entries in Z, 

2) A = A^ 

It is furthermore even unimodular (or of type 11) if 

1 1 2 

||x|| =0 mod 2,Vx € A. 

Note that a unimodular lattice has fundamental volume equal to 1. Unimodular lattices are in particular 
isodual lattices, for which the weak secrecy gain is reached in y = 1, or logy = (see Proposition [U, 
and conjectured to be equal to the strong secrecy gain. We start by giving two examples of computations 
of the weak secrecy gain for two exceptional even unimodular lattices and A24. 

A. The Secrecy Gain of Two Exceptional Unimodular Lattices 

The most important formulas we will use are related to Jacobi theta functions (I22l)-(l24l) and can be 
found in ||33l . They are 

^2(e-) = i?4(e-") 

t?3(e-") = v^i94(e-") (28) 

Gosset Lattice Eg: We evaluate the value of the secrecy function at the point y = 1 (Figure |6] 
displays the secrecy function of Eg). From Table JIJ we have that 

^ ..^ ^3(e--)^ 

It is easier to look at {EE^{y))~^ , which we evaluate in ?/ = 1: 

1 _ 1 (7^2(6-")^ + Me-^^f + ^4(e-")^) 

2 V 4T?4(e-")8 J 

3 

4 

using (|28] ). We thus deduce that the secrecy gain of Eq is 

XE, = ^EsW = 2 = 1.33333 
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Fig. 9. Secrecy function of A24 



Leech Lattice A24." From Table JIl we get 

1 _ \ {^e-^f + ^3(e-")' + ^4(e-")')' - i^2(e-")'^3(e-")'^4(e-") 

63 
256 

again using ( [28] ). showing that the secrecy gain of A24 is 



=Sa.4(1) = — = 4.0635 



The secrecy function of A24 is shown on Figure |9] 



B. Theta series of Even Unimodular Lattices 

The theory of theta series of even unimodular lattices is well establishecj^. We first give some definitions 
that will be useful for the calculation of the secrecy gain. 
Definition 7: Consider the following two series 

'^'^ m=l ^ 

and 

G2k{q) = KmE2k{q). 
^They are actually modular forms with integral weight jS], jSJ 
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where are the BernouUi numbers 11291 defined by 

oo I 

k is an integer such that k > 2, ( is the Riemann zeta function, and q = e™^, Im(z) > 0. These series 
are referred tj^l as Eisenstein series |[8] Chap. 2, §5]. 

Note that these definitions hold for even k', so that depending on the notations, one can write either k' 
even, or as we choose here k' = 2k, for k a positive integer. Furthermore, the argument q can be either 
q = e*'^^ OT q = e^*'^^. Since so far we have always used q = e^'" , we keep this notation but then have 
to introduce a power of 2 in the exponent of q. 

The Riemann zeta function C, and the Bernoulli numbers are related by 

and it is known |[29l that i?4 = — 1/30, -Bg = 1/42. This allows us to compute that 

(60G4(g))3- 27(140G6((7))2 = {UQCi^) f E^{qf - 21 {2ma&) f E(s{qf 

= ^^mqf-E,{qf). 

We call 

A(g) = ^ - (31) 

the function that appears in the above computation, up to a factor of (27r)^^ |[8l Chap. 2, §5], which is 
called the modular discriminanic 

Remarkably, theta series of all even unimodular lattices can be expressed as polynomials in the two 
variables E/^{q) and A(g): 

Proposition 3: If A is an even unimodular lattice of dimension n, then 

1) n = 24m + 8k, for some positive integer m, and some k G {0, 1,2} (as a consequence, n is a 
multiple of 8), 

2) its theta series can be expressed, given k, m in 1), as 

m 

QAiq) = Ef-+\q) + h,Ef''-'^^^\q)^^{q), b, G Q. (32) 
i=i 

'The expression we use here as a definition is classically derived as a Fourier transform of another expression; G2k(j) = 
1 E™,„ („4„)2. . (m, n) + 0, Im(r) > 0. 
''Different authors may or may not include the factor (27r)^'^ in the definition of modular discriminant. 
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Proof: The proof can be found in ||8l. ■ 
Now the two "base" series £'4(9) and A(g) are simply related to the Jacobi theta functions as ||6] 

(33) 

Equations ( [33] ) and ( [32l ) can be used to obtain a relation between the secrecy gain of an even unimodular 
lattice A of dimension n = 24m + S/c, on the one hand, and the ratios 

and 



PA 



on the other hand, since 

eA(g) ^ (EM)\ ^ , (EMl\ ^ 1^ A(g) 



and thus 



^ m 



We can further deduce that 

Theorem 1: The (weak) secrecy gain of an even unimodular lattice is a rational number. 
Proof: Note that 

1 3 

PEi = = 7, 

XEs 4 



and using (1331 ) and (1281 ). we get 

PA - 



(34) 



??24(e-^) 212- 

The proof then follows from Equation (|34] i. ■ 

C. Extremal Even Unimodular Lattices 

Eg and A24 are extremal even unimodular lattices in dimensions 8 and 24 respectively ||6l. We define 
below what is an extremal even unimodular lattice. 
Since we have that 

00 00 

EM = 1 + E ^('?) = E '^^■9'' 
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Dimension 


Lattice A 




c 
o 




_C/4 


24 




K? — 72nA 


32 




Et - 960^4 A 


48 


P48 


£| - 1440£| A + 125280 A^ 


72 


^72 


Et - 2160^1 A + 965520SI A^ - 27302400A^ 


80 


-£'80 


El° - 2400£lA + 1360800£i A^ - 103488000£'4A^ 



TABLE III 

Theta series of extremal lattices 



for some coefficients oij^fij, we liave from (l32l i tfiat 

oo 

for an even unimodular lattice. In order for it to be extremal, we set the coefficients 7j = 0, j = 1, . . . , m, 
which yields a linear system of m equations with m unknowns given by bi, . . . ,bm- We then obtain the 
following development of the theta series of A: 

GA(g) = 1 + 72m+2g''"+' + O 

and consequently as upperbound for the minimum norm of A: 

u= min ||x||^ < 2|m| +2. (35) 
xeA\{0} 



Unimodular lattices achieving the upperbound (I35l l are called extremal and their theta series, determined 
by solving the above system of linear equations in bj, are called extremal theta series. They are given 
in Table |lll] for dimensions 8 to 80. We notice that there is only one extremal theta series for a given 
dimension. Note that knowing the theta series does not give the corresponding lattice. 

We compute further values of secrecy gains for some extremal even unimodular lattices in higher 
dimensions. The corresponding secrecy functions are shown on Figure [TOl while the different secrecy 
gains are summarized in Table |IVl 

1} Barnes-Wall lattice BWs2' A 32-dimensional extremal lattice is the Barnes-Wall lattice BW32- Its 
theta series is 



3 



-so-Mqf-Mqf-MQf] 
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SO that 



.(1) 



1 / 1 
— 1 + - 
16 V 2 

_9_ 

64' 



1 



^"■16 



and finally its secrecy gain is 



64 



XBW3: 



7.11 



2) Lattice PiSp(q)' There are two different extremal even unimodular lattices in dimension 48, ^43^ 
and P48q in Chap. 5], having, of course the same theta series: 

1 



2048 



[3915i?2(g)''^?3(9)''i94((7) 



16 



+32 {^^(qf + ^.,(qf + ^^(qf) 
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giving 



3915 1440 



2048 

19467 
524288' 



256 



16 



+ 32 1 + 



Hence, 



XP4, 



524288 
19467 



26.93 



3 ) Dimensions 72 and 80/ In the same way, from Table |llll we can compute the secrecy gain for 
an extremal unimodular even lattice in dimension 72 (found by G. Nebe ll23l ) and 80. Note that two 
examples of such lattices in dimension 80 have been given in lO. We have 



Dimension 


8 


24 


32 


48 


72 


80 


Secrecy gain 


1.3 


4.1 


7.11 


26.9 


195.7 


380 



TABLE IV 

Secrecy gains of extremal lattices 



134217728 

YA„ = ~ 195.69 

685881 

536870912 

YA=n = — 379.57 

1414413 

We use the computation of the secrecy gain in dimension 80 to illustrate two claims made earlier. 
1) We saw, in Equation (|20l ). the following approximation of the theta series: 

^ q-\\tr l + r(Ae)(7-'^-"(^=)'. 
teAe 

If we were to use this approximation to compute the secrecy gain, we would get 



1 + 1606"'^ 
1 + 12501720006-^ 



instead of 379.57. This illustrates the importance of considering the whole theta series. 
2) Since the secrecy gain approximates the ratio of the respective probabilities of correct decision, we 
have that 

p ^ - XAso - 380. 

We thus reduce Eve's probability of correct decision of a factor of 380 by using Ago instead of 
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VI. Asymptotic Analysis of the Secrecy Gain for Even Unimodular Lattices 



In this section, we provide an asymptotic analysis of the secrecy gain XA for even unimodular lattices 
4fl We first give a lower bound on the maximal value of XA over all even unimodular n— dimensional 
lattices, which only depends on the dimension 7i, after which we show more generally that as n grows, 
the secrecy gain itself only depends on n, and not on the choice of a particular unimodular lattice. 



A. A lower bound on the maximal secrecy gain 

We propose here a lower bound on the theta series of unimodular lattices that maximizes the secrecy 
gain, as a function of the dimension n. We then let n grow to get an asymptotic bound. This result relies 
on the following Siegel-Weil formula for theta series of even unimodular lattices. 

Theorem 2: ||29l Let n = (mod 8), Q.n be the set of all inequivalent even unimodular n— dimensional 
lattices and set /c = ^. Then 

0^(D 



E 

Aen„ 



|Aut(A)| 



where 



E 

AGn„ 



Mn ■ Ek (q) 



1 



|Aut(A)| 



Ek{q) is the Eisenstein series (|29H^l and Aut(A) refers to the group of automorphisms of A. 



Let e^^lie-^) = minA6n„ eA(e-"). Then 



|Aut(A)| 



so that 



Define 



where Il33l 



Xn 



maxxA 
Aen„ 



^3 (e-^) 



7r4 



L086 



^Theta series of even unimodular lattices are in fact modular forms for the whole modular group SL2 (Z), and all the results 
explained in this section actually rely on that property, though we are trying to use it as little as possible so as to make the 
paper accessible for people who are not familiar with the theory of modular forms. 

^The index k is an abuse of notation with respect to Definition i29\ . 
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Now 



Xn > 



i9^(e-^) _ (1.086)" 
Ek (e--) ~ Ek (e— ) ' 



and for k = 4k' a multiple of 4, we have 



2k m*^ ^ 



Bk\ ^ e^^^™ - 1 

m=l 



1 



An asymptotic expression of the Bernoulli number \B/^ki\ is 



'(27r)4fe'- 



Now, as e^'^ 535.5 » 1, we use 



to get 



+0O Ak' — l 

— m 



1 ~ e^""*, m G N\{0} 



g27rm ]^ 



+00 / -27r\™ 



m=l m=l 

where Lis(x) is the polylogarithm function defined as ||2] 



m=l 



Now, we use the identity 111 

Lil-4A:' 



_ {4k' - 1)! 
(27r)4fc' 



[C(4A:', 1 + i) + C(4fe', -i)] 



where C,{s,x) is the so-called Hurwitz zeta function HI. Combining the 3 equations below 

9(C(4fcM + i)) = -9(C(4fc',-z)) 
lim K(C(4A;',l + i)) = 
lim 5R(C(4A;',-i)) = 1 

fe'— >+oo 



with Equation (1381 ). we get 



lim 



Li 



i-4fe' (e 



-27^^ 



1. 



fc^+oo (4A;' - l)!/(27r)4fc' 
Now we are ready to conclude. We combine Equations (|36] |. (l37l l and ( [39l ) to obtain 

fc'^+oo '^'^ ^ ' ^ {2ttY^ {4k' - 1)! 
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Since n = Ak' , we finally conclude that 



which grows exponentially in n. 



400 
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20 40 60 80 

Dimension n 

Fig. 11. Lower bound of the minimal secrecy gain as a function of n from Siegel-Weil formula. Points correspond to extremal 
lattices. 

Figure [H] gives the asymptotic expression of the secrecy gain as a function of the dimension n, as 
well as points corresponding to extremal lattices in dimensions 8, 16, 24, 32, 48, 72 and 80. 

This proves that there exists a family of even unimodular lattices whose secrecy gains exponentially 
grows up with the dimension, which means that Eve's probability of correct decision exponentially tends 
to 0. But as we can remark in Figure (TO] around its maximum, the secrecy function becomes sharper 
and sharper when n grows, meaning that for high dimensions, the communication system absolutely has 
to operate at the operating point (y = 1 for unimodular lattices). 

B. Behavior of the secrecy gain when n grows 

Let us now look at the behavior of the secrecy gain when n grows, which depends on the theta series 
of the corresponding even unimodular lattice A of dimension n, a multiple of 8. The main result used 
here is that the theta series of A is given by 041 Chap. 11] 

QK{q)=Ek{q)+Su{q,k) (41) 



1.086^ 



32 



(40) 
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where Ek{q) is the Eisenstein series given in (|29] l with k = n/2 and Sk^Ail) is a function (a so-called 
cusp form) whose Fourier decomposition is of the form 

oo 
m=0 

where the Fourier coefficients behave as ||28] Chap. 1] 

a (m, A) = Oe ^7712 "4+"^^ . 
On the other hand, the Fourier decomposition of the Eisenstein series is 

where ak-i{m) = X]d|m'^'^~^ '^'^^ divisor function which behaves as 

By combining both Fourier coefficient estimations, we obtain that the Fourier coefficients of the theta 
series 0a((/) in (|4TI) . when n becomes large enough, is dominated by the Eisenstein series which only 
depends on the dimension n. Consequently, when n grows, the theta series of all even unimodular lattices 
behave like the Eisenstein series Ek{q), which, in terms of secrecy gain XA, means 

(1.08)" 

for any n— dimensional (n large enough) even unimodular lattice A. 

VII. Wiretap Lattice Codes 
We conclude this paper by giving some examples of code construction. 



A. An 8-dimensional 2-level nested lattice code construction 

Suppose that Alice communicates with Bob using an 8-dimensional lattice. She needs to decide both 
A;,, that encodes bits for Bob, and Ag, that contains random bits intended for Eve. She can take A;, = £'§, 
since this lattice has the best coding gain (Hermite constant) in dimension 8 IS. Based on her knowledge 
of Bob's SNR, 7b = Es/a^, and Bob's desired error probability, Alice decides the shaping region TZ and 
thus, the total rate R = Re + Rs of transmission. 

Now Ag has to be a sublattice of £'§, which first optimizes the secrecy gain. Since E^ is an extremal 
lattice, all its scaled versions reach the lower bound on the maximal secrecy gain xs and consequently. 
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we pick Ag = 2"^Es. Note that the scaling factor has to be a power of 2 since Ag has to be a sublattice 
of Ah = Eg. This further quantizes the rate Rs as follows: 

Ik 

\Es/2"'Es\ =2^^^R, = - = 2m, 

o 

and we have from (l27l l that 

R — Rs = Re 

= log2(7e) - log2(27r) 
7e(dB) 



10 

7e(dB) 



Iog2l0-log2(27r) 
(3.32) - (2.65). 



10 

Thus since we are under the assumption that Alice knows Eve's SNR, 7e, she accordingly decides how 
many random bits to send. For example 

7e(dB) = 10 dB, i?e ~ 0.67 
7e(dB) = 20 dB, ~ 4. 

Of course, the better Eve's SNR, the more random bits are needed. Now, R is fixed by Bob's SNR while 
Re is given by Eve's SNR which constraints the data rate to be 

Rs = R — Re, Rs = 2m, m G Z. 

For example, if R ^ 6 bits and Eve has a SNR of 7e = 20 dB, then Alice can send Rs = 2 bits per 
complex channel use, which means that Ag = 2Es. 

The encoding is done via construction A, as explained in Section |lll First as already seen earlier, 

^8 = ^2^^ + ^(8,4,4) (42) 
v2 

where C = (8, 4, 4) stands for the Reed-Miiller code of length 8 and dimension 4 and since = 
2Z8 + (8,8, 1), we have 

i?8 = V2Z8 + -L(8,8,l) + -^(8,4,4). (43) 
We denote by the quotient code = F^/C, or equivalently 

¥l = C + C^ i.e., (8, 8, 1) = (8, 4, 4) + Cl 

so that (|43] ) becomes 

Es = V2Z' + ^ (8, 4, 4) + i=Ct + i= (8, 4, 4) = V2Z^ + -1=C\ 
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and 



Combining with = \f21? + 4=(8,4, 4), we finally obtain a construction of £'§ using 2E^: 



Now the A; = 8 bits of information are used to encode (8, 4, 4) + 2(7^" (4 bits for (8, 4, 4) and 4 bits for 
2C^). The 16 random bits on the other hand label 1E^. The encoding can be done again via construction 
A, since we have from (l42l ) that 



for which we need 4 random bits for \f2- (8, 4, 4) and the rest for 4Z^ (in particular, we need a minimum 
of 4 random bits). 

B. An 8-dimensional N -level nested lattice code construction 

In the above example, Alice could choose the number of random bits to be sent since she knew Eve's 
SNR. Suppose now a scenario where Alice perfectly knows Bob's SNR but has no idea of Eve's SNR, 
actually Alice does not even need to know that Eve is present. In this case, the idea we want to develop 
is that Alice can decide a hierarchy of secret bits, ranking the data bits from the most secret to the least, 
and encode them accordingly. In this case, the role of the random bits in the coset coding scheme is 
played by the least secure bits, whose cardinality depends on Eve's SNR. This idea has been formulated, 
from an information theoretic point of view, in llBOl . 

We now illustrate this idea by extending the example of Subsection IVII-AI 

First, we need a tower of nested lattices in dimension 8 |[T3l . We give in Table IVl the construction A 
of all nested lattices from to 2Z^. This table is read by using a generic binary construction A 



where C is an (8, A;, d) code whose generator matrix Gk can be obtained by taking the k last rows of 



Es = 2Es + — [ (8 




2Es = 2\/2Z^ + V^(8,4,4) 



A = 2Z« + C 



(44) 
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Lattice A 


Code C 


/Li 


I'S 8 1 


^8 




rP- 


/o o^i — ^ 
(Oj Dj — \% •Ji 


T a 








2LI 


(8,3,4) = (8,5,2)^ 


2{Dlf 


(8, 2, 4) = (4, 1,4)2 = ((4, 3, 2)^)' 


2DI 


(8, 1,8) = (8, 7, 2)^ 


21? 


(8,0,(x>) 



TABLE V 

Construction A for nested 8— dimensional lattices 



G 



(45) 



the following matrix G: 

'"oooooool 

1 1 

1 1 

1 1 

1 1 1 1 

10 10 10 1 

1 1 1 1 

11111111 

As all codes used in Table |V] are nested codes, all constructed lattices are nested lattices satisfying 

D 15 -D? D Lg D ^2^8 D 2LS D 2 (L>|)* D 21)? D 21?. (46) 



Since this nested chain is periodic (2Z is just a scaled version of Z ), we can shift it in such a way that 
we obtain the chain 



D DtDl^ D DsD DjD LsD V2Es. 



(47) 



While in Subsection IVII-AI we considered 



we now get the same two nested (and scaled) lattices but with a finer chain of lattices in between. 
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To transmit k information bits to Bob, that is 




bits per complex channel use, Alice chooses again Ab = Eg, and needs 



For instance, to send k = I bit, Alice takes from (l47l l the lattice Ag = Lg. Similarly, for fc = 2 bits, she 
uses Ag = {Diy. 



Since Alice does not know Eve's SNR, she decides the total rate R, based on the channel to Bob. 
Suppose that Alice wants to encode a sorted block of £ information bits s = [sq, si, . . . , where by 

sorted we mean that the bit order matters: the bits are ranked in decreasing order of confidentiality, that 
is the first bit is the most confidential. 

Let us start by showing how the coding is done using Ah = Z^. The extension to A;, = £"8 will follow. 
a) Lattice coding when Af, = X^: Let us write 



obtained by Euclidean division of i by 8, and accordingly we form q blocks s,„ = (sgmi ■ ■ ■ , ssm+r) of 
8 bits each, m < q and get an extra block Sg = {ssq, • • • , sg^+r-i, 0, . . . , 0) containing r bits. Each of 
the q blocks of bits is encoded using the generator matrix G in (l45l) : 



and the final transmitted point is 

q 

X = J] 2-c„ (48) 

m=0 

translated by a constant vector, depending on the constellation, so that the mean value of the constellation 



i = 8q + r, 0<r<8 



c 




SqG 



is 0. 



Let us now see how it works. Let go, gi 



. . . , g7 denote the rows of the matrix G. Thus, 



c 



SSmSO + S8m+lgl H h S8m+7g7, , m = 0, 1, . . . , g - 1 



(49) 



and similarly 



Cq = SSqgO + SSg+lgl H h SSq+r-lgr-l 



(50) 
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SO that the final transmitted point of Equation (1481 ) can now be written as 

q-l 

X = ^ 2"" (ssmgO + S8m+lgl H h SSm+Zg?) + 2'' (sgggo + ^Sg+lgl H h SSg+r-lgr-l) 



m=0 



SOgO + Sigi + S2g2 + • • • + S7g7 + 2 ^ 2"" ^C^ G Sogo + 



\ m=l / 

Indeed, 

1) The vector go = (0, 0, 0, 0, 0, 0, 0, 1) i D^. 

2) The term sigi + S2g2 + • • • + s/gy is in since the 7x8 matrix whose rows are gi, • • • , gy is 
the generator matrix of the (8, 7, 2) code which yields via construction A. 

3) The last term is obviously in 2Z^ which is contained in Dg. 

If So = 0, X G Dg, else x G Dg + go and the minimum squared Euchdean distance between Dg and 
^8 + go is equal to 1 which is the minimum distance of = A;,. Consequently so is the bit most 
sensitive to noise, that is the one with highest bit error probability. Note that, from a reliability point of 
view So is the worst bit whereas it is the best one, from a security point of view. 
Let us repeat the process. We have 

Slgl + ( S2g2 + • • • + S7g7 + 2 XI 2""^c„, J G Sigi + {Dif 
\ m=l / 

and the minimum squared Euchdean distance between (1)4)^ and (1)4)^ + gi is the minimum distance 
of Dg, that is 2. The probability of correct decision on the bit si is then higher than for sq. 

This process is iterated for Sj, j = 2,3, ... ,7 where the lattice corresponding to the bit sj has a 
minimum squared Euclidean distance larger or equal to the one of the bit Sj_i. When reaching the bit 
sg (m = 1), we get the lattice 2Z^ (recall that we had for so). The chain of lattices obtained for si 
is then the same one as for sq scaled by a factor of 2. More generally, the chain of lattices for is the 
same one as for sq scaled by a factor of 2™, that is 

A™,. = 2™+iz8 + 2"(8,K,d) 

based on the chain of codes {8,K,d) of Table IVl by using a scaled construction A. The last block of r 
bits will encode the cosets of the code (8, (8 — r),d) giving the transmitted point 

X = ^ ^X 2"'Cm^ + 2^ (Sgggo + Sgg+igi H h S8q+r-2gr-2)j + 2'^ Sgq+r-lgr-l 

where, as above, the bit sg^+r-i decides whether x G Aq^g-r-i or x G Aq^g_r-i + gr-i- 
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Now, 

y \m=0 / j=0 J 

where the bits sgq+r, ■ ■ ■ , sgq+r label points of the lattice 

A, = 2'^+iZ^ + 2« (8,8-r, d) 

whereas the other bits label the cosets in A^/A^ whose coset representatives are chosen in the Voronoi 
cell of the point in As . Since sg^+j, = • • • = sgg+T = 0, they label the point in A^ which can be 
interpreted as saying that x is in the Voronoi cell of the point in A^. In other words, the Voronoi cell 
of the point in A^ is the shaping region TZ of the transmitted constellation |j9]. 

b) Lattice coding when A;, = E^: We now extend the above encoding to the case where A;, = E^. 
Take the block of information bits s = (sq, si, S2, • • • , si-i) and prepend 4 bits equal to to form 

s = (0, 0, 0, 0, So, si, S2, . . . , Si-i) . 

As above, we first compute 

Co = (0, 0, 0, 0, So, si, S2, S3) G, 

a codeword of the Reed-MAiller code (8,4,4), which, by construction A gives a lattice point in E'g, 
after which the whole encoding procedure described for Z*^ holds. 

VIII. Conclusion 

In this paper, we considered coding strategies based on lattices, for the Gaussian wiretap channel. From 
the expression of the eavesdropper probability of correct decision, we derived the so-called secrecy gain, 
a new lattice invariant related to theta series, which characterizes the amount of confusion that lattice 
coding introduces at the eavesdropper. Since theta series of even unimodular lattices are well-understood, 
we focused, in this paper, on the study of the secrecy gain of even unimodular lattices: we provided 
explicit examples and an asymptotic analysis which shows that the secrecy gain grows exponentially in 
the lattice dimension. Finally, worked out coding examples were given. 
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Appendix 

In this appendix, we review results that are needed to manipulate sums of periodic functions over 
lattices. In particular, we will detail the Poisson summation formula over lattices and the Jacobi formula. 

Consider the function -F(x) = X^meZ" /("^ + ^) which is periodic over [0, 1]", for / a well-behaved 
function, that is satisfying |[8| 

1) /r" 1/(2^)1 dx <oo 

2) XlmeZ" + converges uniformly for all u belonging to a compact subset of M". 
It has a Fourier series F{x) = XlneZ" a.ne^'^^^^'^K where 

an = [ e-2-<"'y>F(y)dy 

J[0,1]" 

= I e-2-<"'^>/(m + y)dy 



f e-2^^<"'">/(u)du = /(n) 



where /(n) is the Fourier transform of /, which is such that we can invert the sum and the integral in 
the second step, and reconstruct the integral in the fourth step. Thus 

F(x) = J] /(m + x) = J] a„e2-<"'^> = J] /(n)e2-<"'''> 

meZ" neZ" n6Z" 

which yields, in x = 0, the so-called Poisson summation formula: 



/(m) = fin). 



meZ" ne2 



(51) 



One can be more general and consider summing / on the points of an arbitrary lattice A, say with 
generator matrix M, instead of Z": 

mSA x6Z" yeZ" 
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using (ISTI ). Now 



foMiy) 



-27ri(y,x) 



f{Mx)dx 



= |det(M)|-V7(M-ify), 
giving the Poisson summation formula for lattices: 





|det(M)|-i /(n) 




nsA* 



(52) 



where A* has generator matrix (M ^)^. The lattice A* is the dual lattice of A (see also Definition [T]). 
Let 0A(y) = XlreA ^ '^^"'^"^ '■'^^ theta series of A with generator matrix M, which we rewrite as 

0A(y) = Er6A/('^)' so ^s to ^ppiy <E21>: 

GA(y) = |det(Af)|-i J] /(n) 



n6A* 



where 



/(n) = I e-2^^(".'')/(x)dx 

g-27ri(n,x) g-7ry I |x| |2 



n 
, = 1 



We conclude that 



eA(y) = |det(M)ri J] ("^Ve-^ll" 
which yields the Jacobi's formula lH 



WVy 



eA(y) = |det(M)|-i{-^) OA^il/y), 



(53) 



connecting the theta series of a lattice and its dual. 
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